Nov 2, 2026, 1:31 PMKinda sad about the OpenSSH choice of post-quantum auth algorithm, Ed25519 + ML-DSA-44.
I would have gone with pure ML-DSA-44, but hybrid had one advantage: hardware support.
Unfortunately, they chose Ed25519 which won't work with TPMs, SEs, and pre-2024 PIV YubiKeys.
Nov 2, 2026, 1:31 PMGiven this, I *could* make yubikey-agent support these keys on YubiKey 5.7+ (with Ed25519 touch-protected, and ML-DSA just PIN-wrapped), but if most folks will need to buy a new YubiKey anyway, they might as well wait and buy a proper ML-DSA one next year...
@filippo
Fwiw, ed25519 is slated for TPMs along with the PQC support.
Nov 2, 2026, 1:49 PM@Foxboron right, but it's the same as with YubiKeys: on the new hw you might as well do ML-DSA directly, so it's not the hybrid buying you hw protection.
@filippo
Ah right, I haven't really read too much into the hybrid vs non-hybrid discussion in this area.
@filippo do you have any source that confirms that pq yubikeys will arrive next year?
Nov 3, 2026, 5:05 PM@peter no, it just feels unlikely they will come in the next two months but also unlikely that they will not come for the next 14 months.
> Unfortunately, they chose Ed25519 which won't work with TPMs, SEs, and pre-2024 PIV YubiKeys.
Is that maybe some governmental/compliance recommendation?
Like e.g. the BSI here in Germany states X25519MLKEM768 as one of the options for e.g. TLS 1.3
@filippo Hybrid is absolutely required if you want PQ. Even if you irrationally (no proven history of standing up to attacks while protecting things of high value) trust PQ algorithms, non-expert users can't and shouldn't. They will view a non-hybrid PQ as an intentional backdoor. OpenSSH is 100% in the right here.